PROCERT: Action Items

This bug records the remediation action items PROCERT must complete before it may re-apply for inclusion of a new trust anchor in Mozilla’s Root Store after the PSCProcert certificate was removed. The removal was described as being due to a long list of problems and PROCERT’s response to those problems, with details referenced in Bug #1391058 and the wiki page https://wiki.mozilla.org/CA:PROCERT_Issues. The bug states that PROCERT may apply for inclusion of a new certificate only after completing four actions: (1) provide a list of planned changes to prevent future violations of Mozilla’s CA Certificate Policy and the CA/Browser Forum Baseline Requirements, (2) implement those changes and update CP/CPS, (3) provide a public-facing attestation from an external, Mozilla-acceptable licensed auditor that the changes have been made, and (4) provide auditor attestation that a full performance audit confirming Baseline Requirements compliance has been performed. The thread also clarifies that the CA must not re-apply until all listed actions and resulting documents/audits are approved by Mozilla in this bug. Mozilla marked Bug 1396858 as a duplicate of this bug, and the root certificate was removed via Bug #1403549, with Mozilla noting it does not need to track this bug further. The bug is currently resolved as WONTFIX.

1. 2017-10-04 Mozilla removed the PSCProcert certificate from its Root Store via Bug #1403549.

1. 2017-10-04 Community commenter — Opened the bug to document PROCERT’s required action items before it can re-apply for a new trust anchor, listing the four remediation and audit/attestation requirements.
2. 2017-10-16 Community commenter — Clarified that PROCERT must re-apply through Mozilla’s application process only after all actions and Mozilla approvals are completed, and reiterated full compliance expectations.
3. 2017-11-20 Community commenter — Noted that Bug 1396858 was marked as a duplicate of this bug.
4. 2017-11-20 Community commenter — Stated the root cert was removed via Bug #1403549, so Mozilla does not need to track this bug, and that PROCERT may re-apply after completing the action items.